linux-kernel - Re: [RFC] Circumventing FineIBT Via Entrypoints

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8734fyqncg.fsf@mid.deneb.enyo.de>
Date: Fri, 28 Feb 2025 13:13:03 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: Andrew Cooper <andrew.cooper3@...rix.com>
Cc: Jann Horn <jannh@...gle.com>,  jmill@....edu,  joao@...rdrivepizza.com,
  kees@...nel.org,  linux-hardening@...r.kernel.org,
  linux-kernel@...r.kernel.org,  luto@...nel.org,  samitolvanen@...gle.com,
  "Peter Zijlstra (Intel)" <peterz@...radead.org>
Subject: Re: [RFC] Circumventing FineIBT Via Entrypoints

* Andrew Cooper:

> The SYSCALL behaviour TLDR is:
>
>     %rcx = %rip
>     %r11 = %eflags
>     %cs = fixed attr
>     %ss = fixed attr
>     %rip = MSR_LSTAR
>
> which means that %rcx (old rip) is the only piece of state which
> userspace can't feasibly forge (and therefore could distinguish a
> SYSCALL from user vs kernel mode), yet if we're talking about a JOP
> chain to get here, then %rcx is under attacker control too.

Will the syscall handler do anything useful if called with an invalid
system call number?

If not, and if you can changed the FineIBT cookie register to %rax,
would that address this particular gap?  As long as the cookies do not
overlap with valid system call numbers?